Add a dedicated pf pool for route options as suggested by henning,

which unbreaks ie route-to after the recent pf changes.

With much help debugging and pointing out of missing bits from claudio@

ok claudio@ "looks good" henning@

3 files changed, 56 insertions, 28 deletions

diff --git a/sys/net/pf.c b/sys/net/pf.c
index 541a19cafa1..fbb28db0073 100644
--- a/sys/net/pf.c
+++ b/sys/net/pf.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf.c,v 1.664 2009/10/06 21:21:48 claudio Exp $ */
+/*	$OpenBSD: pf.c,v 1.665 2009/10/28 20:11:01 jsg Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -104,7 +104,7 @@
 struct pf_state_tree	 pf_statetbl;
 
 struct pf_altqqueue	 pf_altqs[2];
-struct pf_palist	 pf_pabuf[2];
+struct pf_palist	 pf_pabuf[3];
 struct pf_altqqueue	*pf_altqs_active;
 struct pf_altqqueue	*pf_altqs_inactive;
 struct pf_status	 pf_status;
@@ -2602,15 +2602,16 @@ pf_set_rt_ifp(struct pf_state *s, struct pf_addr *saddr)
 	switch (s->key[PF_SK_WIRE]->af) {
 #ifdef INET
 	case AF_INET:
-		pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, &sn, &r->rdr);
-		s->rt_kif = r->rdr.cur->kif;
+		pf_map_addr(AF_INET, r, saddr, &s->rt_addr, NULL, &sn,
+		    &r->route);
+		s->rt_kif = r->route.cur->kif;
 		break;
 #endif /* INET */
 #ifdef INET6
 	case AF_INET6:
 		pf_map_addr(AF_INET6, r, saddr, &s->rt_addr, NULL, &sn,
 		    &r->rdr);
-		s->rt_kif = r->rdr.cur->kif;
+		s->rt_kif = r->route.cur->kif;
 		break;
 #endif /* INET6 */
 	}
@@ -4988,18 +4989,18 @@ pf_route(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
 		if (ro->ro_rt->rt_flags & RTF_GATEWAY)
 			dst = satosin(ro->ro_rt->rt_gateway);
 	} else {
-		if (TAILQ_EMPTY(&r->rdr.list)) {
+		if (TAILQ_EMPTY(&r->route.list)) {
 			DPFPRINTF(PF_DEBUG_URGENT,
-			    ("pf_route: TAILQ_EMPTY(&r->rdr.list)\n"));
+			    ("pf_route: TAILQ_EMPTY(&r->route.list)\n"));
 			goto bad;
 		}
 		if (s == NULL) {
 			pf_map_addr(AF_INET, r, (struct pf_addr *)&ip->ip_src,
-			    &naddr, NULL, &sn, &r->rdr);
+			    &naddr, NULL, &sn, &r->route);
 			if (!PF_AZERO(&naddr, AF_INET))
 				dst->sin_addr.s_addr = naddr.v4.s_addr;
-			ifp = r->rdr.cur->kif ?
-			    r->rdr.cur->kif->pfik_ifp : NULL;
+			ifp = r->route.cur->kif ?
+			    r->route.cur->kif->pfik_ifp : NULL;
 		} else {
 			if (!PF_AZERO(&s->rt_addr, AF_INET))
 				dst->sin_addr.s_addr =
@@ -5170,18 +5171,18 @@ pf_route6(struct mbuf **m, struct pf_rule *r, int dir, struct ifnet *oifp,
 		return;
 	}
 
-	if (TAILQ_EMPTY(&r->rdr.list)) {
+	if (TAILQ_EMPTY(&r->route.list)) {
 		DPFPRINTF(PF_DEBUG_URGENT,
-		    ("pf_route6: TAILQ_EMPTY(&r->rdr.list)\n"));
+		    ("pf_route6: TAILQ_EMPTY(&r->route.list)\n"));
 		goto bad;
 	}
 	if (s == NULL) {
 		pf_map_addr(AF_INET6, r, (struct pf_addr *)&ip6->ip6_src,
-		    &naddr, NULL, &sn, &r->rdr);
+		    &naddr, NULL, &sn, &r->route);
 		if (!PF_AZERO(&naddr, AF_INET6))
 			PF_ACPY((struct pf_addr *)&dst->sin6_addr,
 			    &naddr, AF_INET6);
-		ifp = r->rdr.cur->kif ? r->rdr.cur->kif->pfik_ifp : NULL;
+		ifp = r->route.cur->kif ? r->route.cur->kif->pfik_ifp : NULL;
 	} else {
 		if (!PF_AZERO(&s->rt_addr, AF_INET6))
 			PF_ACPY((struct pf_addr *)&dst->sin6_addr,
diff --git a/sys/net/pf_ioctl.c b/sys/net/pf_ioctl.c
index 787ffa28f6d..10d10931b2e 100644
--- a/sys/net/pf_ioctl.c
+++ b/sys/net/pf_ioctl.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pf_ioctl.c,v 1.221 2009/10/06 02:31:36 mcbride Exp $ */
+/*	$OpenBSD: pf_ioctl.c,v 1.222 2009/10/28 20:11:01 jsg Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -189,6 +189,7 @@ pfattach(int num)
 	TAILQ_INIT(&pf_altqs[1]);
 	TAILQ_INIT(&pf_pabuf[0]);
 	TAILQ_INIT(&pf_pabuf[1]);
+	TAILQ_INIT(&pf_pabuf[2]);
 	pf_altqs_active = &pf_altqs[0];
 	pf_altqs_inactive = &pf_altqs[1];
 	TAILQ_INIT(&state_list);
@@ -298,6 +299,8 @@ pf_get_pool(char *anchor, u_int32_t ticket, u_int8_t rule_action,
 		return (NULL);
 	if (which == PF_NAT)
 		return (&rule->nat);
+	else if (which == PF_RT)
+		return (&rule->route);
 	else
 		return (&rule->rdr);
 }
@@ -371,6 +374,7 @@ pf_rm_rule(struct pf_rulequeue *rulequeue, struct pf_rule *rule)
 	pf_anchor_remove(rule);
 	pf_empty_pool(&rule->rdr.list);
 	pf_empty_pool(&rule->nat.list);
+	pf_empty_pool(&rule->route.list);
 	pool_put(&pf_rule_pl, rule);
 }
 
@@ -1102,6 +1106,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 		rule->kif = NULL;
 		TAILQ_INIT(&rule->rdr.list);
 		TAILQ_INIT(&rule->nat.list);
+		TAILQ_INIT(&rule->route.list);
 		/* initialize refcounting */
 		rule->states_cur = 0;
 		rule->src_nodes = 0;
@@ -1186,6 +1191,9 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 		TAILQ_FOREACH(pa, &pf_pabuf[1], entries)
 			if (pf_tbladdr_setup(ruleset, &pa->addr))
 				error = EINVAL;
+		TAILQ_FOREACH(pa, &pf_pabuf[2], entries)
+			if (pf_tbladdr_setup(ruleset, &pa->addr))
+				error = EINVAL;
 
 		if (rule->overload_tblname[0]) {
 			if ((rule->overload_tbl = pfr_attach_table(ruleset,
@@ -1198,9 +1206,10 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 
 		pf_mv_pool(&pf_pabuf[0], &rule->nat.list);
 		pf_mv_pool(&pf_pabuf[1], &rule->rdr.list);
+		pf_mv_pool(&pf_pabuf[2], &rule->route.list);
 
 		if (rule->rt > PF_FASTROUTE &&
-		    (TAILQ_FIRST(&rule->rdr.list) == NULL))
+		    (TAILQ_FIRST(&rule->route.list) == NULL))
 			error = EINVAL;
 
 		if (error) {
@@ -1209,6 +1218,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 		}
 		rule->nat.cur = TAILQ_FIRST(&rule->nat.list);
 		rule->rdr.cur = TAILQ_FIRST(&rule->rdr.list);
+		rule->route.cur = TAILQ_FIRST(&rule->route.list);
 		rule->evaluations = rule->packets[0] = rule->packets[1] =
 		    rule->bytes[0] = rule->bytes[1] = 0;
 		TAILQ_INSERT_TAIL(ruleset->rules[rs_num].inactive.ptr,
@@ -1351,6 +1361,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 			newrule->cpid = p->p_pid;
 			TAILQ_INIT(&newrule->rdr.list);
 			TAILQ_INIT(&newrule->nat.list);
+			TAILQ_INIT(&newrule->route.list);
 			/* initialize refcounting */
 			newrule->states_cur = 0;
 			newrule->entries.tqe_prev = NULL;
@@ -1432,6 +1443,9 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 			TAILQ_FOREACH(pa, &pf_pabuf[1], entries)
 				if (pf_tbladdr_setup(ruleset, &pa->addr))
 					error = EINVAL;
+			TAILQ_FOREACH(pa, &pf_pabuf[2], entries)
+				if (pf_tbladdr_setup(ruleset, &pa->addr))
+					error = EINVAL;
 
 			if (newrule->overload_tblname[0]) {
 				if ((newrule->overload_tbl = pfr_attach_table(
@@ -1445,9 +1459,10 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 
 			pf_mv_pool(&pf_pabuf[0], &newrule->nat.list);
 			pf_mv_pool(&pf_pabuf[1], &newrule->rdr.list);
+			pf_mv_pool(&pf_pabuf[2], &newrule->route.list);
 			if (newrule->rt > PF_FASTROUTE &&
 			    !newrule->anchor &&
-			    (TAILQ_FIRST(&newrule->rdr.list) == NULL))
+			    (TAILQ_FIRST(&newrule->route.list) == NULL))
 				error = EINVAL;
 
 			if (error) {
@@ -1456,12 +1471,14 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 			}
 			newrule->rdr.cur = TAILQ_FIRST(&newrule->rdr.list);
 			newrule->nat.cur = TAILQ_FIRST(&newrule->nat.list);
+			newrule->route.cur = TAILQ_FIRST(&newrule->route.list);
 			newrule->evaluations = 0;
 			newrule->packets[0] = newrule->packets[1] = 0;
 			newrule->bytes[0] = newrule->bytes[1] = 0;
 		}
 		pf_empty_pool(&pf_pabuf[0]);
 		pf_empty_pool(&pf_pabuf[1]);
+		pf_empty_pool(&pf_pabuf[2]);
 
 		if (pcr->action == PF_CHANGE_ADD_HEAD)
 			oldrule = TAILQ_FIRST(
@@ -1977,6 +1994,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 
 		pf_empty_pool(&pf_pabuf[0]);
 		pf_empty_pool(&pf_pabuf[1]);
+		pf_empty_pool(&pf_pabuf[2]);
 		pp->ticket = ++ticket_pabuf;
 		break;
 	}
@@ -1984,7 +2002,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 	case DIOCADDADDR: {
 		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
 
-		if (pp->which != PF_NAT && pp->which != PF_RDR) {
+		if (pp->which != PF_NAT && pp->which != PF_RDR && pp->which != PF_RT) {
 			error = EINVAL;
 			break;
 		}
@@ -2039,15 +2057,24 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 			break;
 		}
 
-		TAILQ_INSERT_TAIL(&pf_pabuf[pp->which == PF_NAT ? 0 : 1], pa,
-		    entries);
-		break;
+		switch (pp->which) {
+		case PF_NAT:
+			TAILQ_INSERT_TAIL(&pf_pabuf[0], pa, entries);
+			break;
+		case PF_RDR:	
+			TAILQ_INSERT_TAIL(&pf_pabuf[1], pa, entries);
+			break;
+		case PF_RT:
+			TAILQ_INSERT_TAIL(&pf_pabuf[2], pa, entries);
+			break;
+		}
+		break;	
 	}
 
 	case DIOCGETADDRS: {
 		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
 
-		if (pp->which != PF_NAT && pp->which != PF_RDR) {
+		if (pp->which != PF_NAT && pp->which != PF_RDR && pp->which != PF_RT) {
 			error = EINVAL;
 			break;
 		}
@@ -2068,7 +2095,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 		struct pfioc_pooladdr	*pp = (struct pfioc_pooladdr *)addr;
 		u_int32_t		 nr = 0;
 
-		if (pp->which != PF_NAT && pp->which != PF_RDR) {
+		if (pp->which != PF_NAT && pp->which != PF_RDR && pp->which != PF_RT) {
 			error = EINVAL;
 			break;
 		}
@@ -2098,7 +2125,7 @@ pfioctl(dev_t dev, u_long cmd, caddr_t addr, int flags, struct proc *p)
 		struct pf_pooladdr	*oldpa = NULL, *newpa = NULL;
 		struct pf_ruleset	*ruleset;
 
-		if (pca->which != PF_NAT && pca->which != PF_RDR) {
+		if (pca->which != PF_NAT && pca->which != PF_RDR && pca->which != PF_RT) {
 			error = EINVAL;
 			break;
 		}
diff --git a/sys/net/pfvar.h b/sys/net/pfvar.h
index 8d449d68626..701dcdc5078 100644
--- a/sys/net/pfvar.h
+++ b/sys/net/pfvar.h
@@ -1,4 +1,4 @@
-/*	$OpenBSD: pfvar.h,v 1.295 2009/10/06 21:21:48 claudio Exp $ */
+/*	$OpenBSD: pfvar.h,v 1.296 2009/10/28 20:11:01 jsg Exp $ */
 
 /*
  * Copyright (c) 2001 Daniel Hartmeier
@@ -60,7 +60,7 @@ struct ip6_hdr;
 enum	{ PF_INOUT, PF_IN, PF_OUT };
 enum	{ PF_PASS, PF_DROP, PF_SCRUB, PF_NOSCRUB, PF_NAT, PF_NONAT,
 	  PF_BINAT, PF_NOBINAT, PF_RDR, PF_NORDR, PF_SYNPROXY_DROP, PF_DEFER,
-	  PF_MATCH, PF_DIVERT };
+	  PF_MATCH, PF_DIVERT, PF_RT };
 enum	{ PF_RULESET_FILTER, PF_RULESET_NAT, PF_RULESET_BINAT,
 	  PF_RULESET_RDR, PF_RULESET_MAX };
 enum	{ PF_OP_NONE, PF_OP_IRG, PF_OP_EQ, PF_OP_NE, PF_OP_LT,
@@ -543,6 +543,7 @@ struct pf_rule {
 	TAILQ_ENTRY(pf_rule)	 entries;
 	struct pf_pool		 nat;
 	struct pf_pool		 rdr;
+	struct pf_pool		 route;
 
 	u_int64_t		 evaluations;
 	u_int64_t		 packets[2];
@@ -1629,10 +1630,9 @@ extern struct pf_state_tree_id tree_id;
 extern struct pf_state_queue state_list;
 
 TAILQ_HEAD(pf_poolqueue, pf_pool);
-extern struct pf_poolqueue		  pf_pools[2];
 TAILQ_HEAD(pf_altqqueue, pf_altq);
 extern struct pf_altqqueue		  pf_altqs[2];
-extern struct pf_palist			  pf_pabuf[2];
+extern struct pf_palist			  pf_pabuf[3];
 
 extern u_int32_t		 ticket_altqs_active;
 extern u_int32_t		 ticket_altqs_inactive;